AUTHENTICATED , 
US. GOVERNMENT 
INFORMATION ^ 


ATTENTION NEEDED: MISMANAGEMENT AT THE 
SBA - THE GAO FINDINGS 


HEARING 

BEFORE THE 

COMMITTEE ON SMALL BUSINESS 
UNITED STATES 
HOUSE OF REPRESENTATDH]S 

ONE HUNDRED FOURTEENTH CONGRESS 

SECOND SESSION 


HEARING HELD 
JANUARY 6, 2016 



Small Business Committee Document Number 114—034 
Available via the GPO Website: www.fdsys.gov 


U.S. GOVERNMENT PUBLISHING OFFICE 
98-135 WASHINGTON : 2016 


For sale by the Superintendent of Documents, U.S. Government Publishing Office 
Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; DC area (202) 512-1800 
Fax: (202) 512-2104 Mail: Stop IDCC, Washington, DC 20402-0001 


HOUSE COMMITTEE ON SMALL BUSINESS 

STEVE CHABOT, Ohio, Chairman 
STEVE KING, Iowa 
BLAINE LUETKEMEYER, Missouri 
RICHARD HANNA, New York 
TIM HUELSKAMP, Kansas 
CHRIS GIBSON, New York 
DAVE BRAT, Virginia 

AUMUA AMATA COLEMAN RADEWAGEN, American Samoa 
STEVE KNIGHT, California 
CARLOS CURBELO, Florida 
MIKE BOST, Illinois 
CRESENT HARDY, Nevada 
NYDIA VELAZQUEZ, New York, Ranking Member 
YVETTE CLARK, New York 
JUDY CHU, California 
JANICE HAHN, California 
DONALD PAYNE, JR., New Jersey 
GRACE MENG, New York 
BRENDA LAWRENCE, Michigan 
ALMA ADAMS, North Carolina 
SETH MOULTON, Massachusetts 
MARK TAKAI, Hawaii 

Kevin Fitzpatrick, Staff Director 
Emily Murphy, Deputy Staff Director for Policy 
Jan Oliver, Deputy Staff Director for Operation 
Barry Pineles, Chief Counsel 
Michael Day, Minority Staff Director 


(II) 



CONTENTS 

OPENING STATEMENTS 


Page 


Hon. Steve Chabot 1 

Hon. Nydia Velazquez 2 

WITNESS 

William B. Shear, Director, Financial Markets and Community Investment, 
United States Government Accountability Office, Washington, DC 3 


APPENDIX 

Prepared Statement: 

William B. Shear, Director, Financial Markets and Community Invest- 
ment, United States Government Accountability Office, Washington, 

DC 21 

Questions for the Record: 

None. 

Answers for the Record: 

None. 

Additional Material for the Record: 

None. 


(Ill) 




ATTENTION NEEDED: MISMANAGEMENT AT 
THE SBA - THE GAO FINDINGS 


WEDNESDAY, JANUARY 6, 2016 

House of Representatives, 

Committee on Small Business, 

Washington, DC. 

The Committee met, pursuant to call, at 11:00 a.m., in Room 
2360, Rayburn House Office Building. Hon. Steve Chabot [chair- 
man of the Committee] presiding. 

Present: Representatives Chabot, Luetkemeyer, Hanna, 

Huelskamp, Brat, Radewagen, Curbelo, Hardy, Kelly, Velazquez, 
Chu, Meng, Adams, and Moulton. 

Chairman CHABOT. Good morning. I call the Committee hear- 
ing appropriately titled “Attention needed: Mismanagement at the 
SBA” to order. I also want to welcome back a frequent witness be- 
fore this Committee, Bill Shear, of the GAO, the General Account- 
ability Office. 

Since 1946, federal agencies have been required to operate using 
rational decision-making procedures. That is the expectation of tax- 
payers whether it is the law or not. Congress made that sensible 
idea and the expectations of taxpayers the law when it enacted the 
Government Performance and Review Act back in 1993. To operate 
in the manner demanded by statute, agencies must make extensive 
efforts at strategic planning and actually carry that planning out. 

Today, the Committee will hear an assessment from the GAO on 
the SBA’s — that is the Small Business Administration’s efforts to 
deliver effective assistance to entrepreneurs in an efficient manner. 
With a $100 billion loan portfolio, $100 billion, the taxpayer has too 
much invested in this agency to allow mismanagement to continue. 
Barriers to effective and efficient operation of the SBA include the 
failure to address longstanding management challenges, failure to 
develop a human capital plan, failure to institute sound acquisition 
methods, failure to revise outdated policy directives, and failure to 
assess the structure of the agency, among other things. 

The GAO’s conclusions are clear; the SBA needs a complete over- 
haul of its operations. Finding a resolution to these problems will 
not be easy. GAO has taken the first step, identifying the problems 
at the SBA. The next steps are significantly harder. Meaningful so- 
lutions usually are. Problems that have existed for decades will not 
be resolved overnight. It will take the dedicated effort of agency of- 
ficials and the watchful eye of those on this Committee to right 
those wrongs. 

This Committee’s efforts will not end with the review of this re- 
port. We will convene multiple hearings over the next few months 
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to examine SBA programs and their implementation by various 
branches of that Agency. The hearings may reveal other barriers 
to official and effective operations of the SBA that will require fur- 
ther examination by this Committee and by the GAO. If the report 
examined today, subsequent hearings, investigations by the Com- 
mittee, and additional reports by GAO continue to reveal problems 
that the administration will not fix, the Committee will not hesi- 
tate to take legislative action. 

The SBA plays a significant role in providing assistance to Amer- 
ica’s entrepreneurs. The problems that have festered far too long 
must end so that small businesses and taxpayers can rely on an 
effective and efficient SBA. The taxpayers of this country deserve 
no less. 

I would now like to yield to the ranking member for her opening 
statement. , 

Ms. VELAZQUEZ. Thank you, Mr. Chairman. 

Of the many responsibilities this committee has, one of our most 
important, is overseeing and examining the Small Business Admin- 
istration. It is absolutely critical that we conduct this oversight. 
Doing so ensures that tax dollars are spent efficiently and appro- 
priately. GAO has been a long-term partner of this committee’s 
oversight work and has helped us identify and solve a wide range 
of issues affecting the agency’s programs. 

Today’s hearing, however, does not focus on a particular program 
or initiative at the SBA; rather, it focuses on the overall manage- 
ment and strategic vision of the agency. I, along with prior Chair- 
man Graves, requested this broad view of the SBA. 

GAO reported several key findings, many of which cite issues al- 
ready raised by the SBA’s own inspector general over the last dec- 
ade. At the top of the list are organizational matters which are crit- 
ical to the agency’s ability to serve small businesses. GAO found 
the agency structure to be overly complex and that workforce plan- 
ning was not up-to-date. Such redundancies and deficiencies can ul- 
timately lead to poor service to entrepreneurs. In addition, GAO 
found that risk management and IT security are being inappropri- 
ately administered. Such co-activities and internal controls are cen- 
tral to the functioning of the SBA, and without adherence to feder- 
ally-accepted standards, the agency is subjecting itself to unneces- 
sary risks. 

Perhaps the most troubling issues raised by the GAO come into 
areas of procedural guidance and program evaluation. With regard 
to procedural guidance, GAO reported that as of March 2015, SBA 
had determined that 74 of its 165 standard operating procedures 
needed to be revised and 31 needed to be canceled. An additional 
9 needed to be issued. Without guidance, it is impossible for pro- 
gram participants or even the SBA to know how a program should 
operate. This makes it difficult for small firms to work with the 
agency, and given that these SOPs are not issued pursuant to no- 
tice and common rulemaking frustrates those that want greater 
transparency in how government works. The report shows that 
SBA has some work to do in improving its overall management of 
the agency. With that said, I was glad to see SBA has agreed with 
nearly all of the GAO’s recommendations and has begun to take ac- 
tion to address these matters. 
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Today, I am looking forward to hearing from GAO about whether 
or not they believe SBA is carrying through on this commitment. 
This committee stands ready to examine the SBA and its program 
so that small businesses and the taxpayers benefit more broadly. 
It is a vital role and one that I want to ask all committee members 
to take part in. I look forward to hearing the GAO’s testimony, and 
I thank Mr. Bill Shear and his team for their continued work on 
our behalf 

With that, Mr. Chairman, I yield back. 

Chairman CHABOT. Thank you very much. The gentlelady 
yields back. 

And we would ask that Committee members who have opening 
statements prepared, if they would submit them for the record. 

And just to explain very briefly our rules here and the time lim- 
its, which Mr. Shear is very familiar with, I am sure, we operate 
under the 5-minute rule where the witnesses get 5 minutes to tes- 
tify. In this case, we will give you a little bit longer than that if 
you need it. Since there is only one witness and we generally have 
four that does not mean we want you to take 20 minutes, but if 
you need a little bit more time that is okay, and we will limit our- 
selves to 5 minute at least in the first round, and then we will de- 
termine whether we think it is necessary to go into a second round 
at the appropriate time. 

We have a light system there, as you know. The yellow light 
comes on and lets you know you have a minute to wrap up. The 
red light will come on and I will let you go a little bit further than 
that as I indicated. 

And now a brief introduction. Mr. Shear, who is our witness, he 
is the director of Financial Markets and Community Investment 
Team at the Government Accountability Office. Most of us refer to 
it as the GAO around here, and we look very forward to your testi- 
mony. And you are recognized for 5 minutes, or as I say, a little 
bit longer. 

Mr. SHEAR. Thank you. I will keep it under 5 minutes. 

Chairman CHABOT. Okay. Thank you. 

STATEMENT OF WILLIAM B. SHEAR, DIRECTOR, FINANCIAL 

MARKETS AND COMMUNITY INVESTMENT, UNITED STATES 

GOVERNMENT ACCOUNTABILITY OFFICE 

Mr. SHEAR. Chairman Chabot, Ranking Member Velazquez, and 
Members of the Committee, I am pleased to be here this morning 
to discuss our management review of the Small Business Adminis- 
tration. My testimony is based on our September 2015 report and 
related updates on the status of recommendations. Rather than fo- 
cusing on individual SBA programs, we conducted a comprehensive 
assessment of SBA’s structure, processes, and systems, including 
its efforts to address its management challenges. 

In September, we reported that SBA had not resolved many of 
its longstanding management challenges due to a lack of sustained 
priority attention over time. Many of the management challenges 
that we and the Office of Inspector General had identified over the 
years remained, including some related to program implementation 
and oversight, contracting, human capital, and IT. SBA has gen- 
erally agreed with prior GAO recommendations that were designed 
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to address these issues. As we state in our report, the agency had 
made limited progress in addressing most of these recommenda- 
tions but had recently begun to take some steps to address them. 
For example, as of July 2015, SBA had implemented four of six rec- 
ommendations from the 2010 GAO Report on its 8(a) Business De- 
velopment Program. 

In our report, we made eight new recommendations designed to 
improve SBA’s program evaluations, strategic and workforce plan- 
ning, training, organizational structure, enterprise risk manage- 
ment, procedural guidance, and oversight of IT investments. SBA 
generally agreed with these recommendations. We also maintained 
that the 69 recommendations we made in prior work have merit 
and should be fully implemented. 

As of December 2015, SBA had implemented 7 of the 69 rec- 
ommendations from prior reports that were identified in our Sep- 
tember report. For example, with respect to disaster assistance, 
SBA revised its planning documents to adjust staffing and re- 
sources available for future disasters by considering the potential 
effect of early application submissions for disaster loans as we had 
recommended. In addition, SBA officials told us about actions the 
agency had initiated in response to the eight new GAO rec- 
ommendations. For example, the SBA officials told us that the 
agency had established an Economic Impact Evaluation Working 
Group, which according to the SBA officials was developing evalua- 
tion plans for several program offices. 

Chairman Chabot and Ranking Member Velazquez, this con- 
cludes my prepared statement. I would be happy to answer any 
questions. 

Chairman CHABOT. Thank you very much, and you definitely 
kept it under 5 minutes. Thank you. 

I will now recognize myself to begin the questioning. 

Mr. Shear, in the last year, we have seen the Federal Govern- 
ment hacked in a whole series of breaches. 0PM, the Office of Per- 
sonnel Management, had millions of fingerprint records stolen. So- 
cial Security numbers, addresses, health records, financial and bio- 
metric data were all taken. We have seen the IRS hit, the State 
Department, even the White House. Now, in your review of the 
SBA, the Small Business Administration, you have listed a whole 
range of deficiencies, areas where the SBA has fallen short, just 
not cutting it. And the one that worries me the most is in the area 
of IT security. First of all, the information that they keep on indi- 
viduals and on small businesses can be pretty sensitive informa- 
tion. Is that right? Information you might not want a rival busi- 
ness, or your neighbors, or the Chinese government to have access 
to. Would you agree with that and would you like to comment? 

Mr. SHEAR. Chairman Chabot, you raise a very good point. And 
one of the things I just want to say procedurally, that when you 
take such an extensive operational view of an agency like this, we 
certainly partnered with SBA’s Office of Inspector General, and we 
greatly appreciate the interactions we had. And you see in our re- 
port that we refer to the IG’s work quite liberally and some of the 
issues raised by the IG. The issue of IT security is one where we 
relied on and we reported on the IG’s findings. So basically, there 
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are issues identified by the IG that require attention. It is a very 
serious issue, and it is one of the issues 

Chairman CHABOT. Let me interrupt you for a second, if I can. 

Mr. SHEAR. Yes. 

Chairman CHABOT. Despite the logical concern that individuals 
or small businesses who deal with the SBA might have, the SBA 
has failed to implement more than 30 of the Office of the Inspector 
General’s recommendations related to IT security; is that correct? 

Mr. SHEAR. That is what we report based on what was available 
in September. We note that information technology security has 
been identified for well over a decade as a longstanding manage- 
ment challenge. In its most recent report which came out recently, 
there was not a report of the number, but it certainly is one of the 
longstanding management challenges, so I cannot attest to exactly 
what the number is at this time. 

Chairman CHABOT. Okay. I have got 2 minutes left, so let me 
move to a couple other areas that are in your review and that I 
also find disturbing. I will again quote from the review, and I 
quote, “In our September 2015 report, we found that the SBA has 
not resolved many of its longstanding management challenges due 
to lack of sustained priority attention over time.” And you went on 
to say, “This raises questions about the SBA’s sustained commit- 
ment to addressing management challenges to keep it from effec- 
tively assisting small businesses.” 

Now, the principal purpose of even having an SBA is to assist 
small businesses, and it is our responsibility as the Committee of 
oversight, to make sure that the SBA is living up to their respon- 
sibilities to small businesses. So would you like to comment on the 
fact that they lacked the long-term attention to this issue that it 
deserved? 

Mr. SHEAR. It is very disturbing when an agency, we have been 
here, with you Chairman Chabot and with Ranking Member 
Velazquez, and previously with Representative Graves, and it is 
very disturbing to us that these challenges still remain. And they 
go down to some very basic functions. And with all the program au- 
dits that we have done at SBA, one of the reasons why we even 
suggested to the Committee the idea of undertaking such a review 
is that we saw certain recurring themes happen over and over 
again when you look across the agency that affect all aspects of its 
operations and its programs. And so we think that there is some 
work to he done here, and we are looking for some commitment to 
deal with many of these issues, many of which have an internal 
control type of issue which we pay very close attention to. 

Chairman CHABOT. Thank you. I have got more questions but 
in order to impose the same 5 minutes on myself as everybody else, 
I will stop there and I will now yield to the ranking member, Ms. 
Velazquez. ^ 

Ms. VELAZQUEZ. Thank you, Mr. Chairman, and thank you, 
Mr. Shear, for being here. 

In the report, GAO found that the SBA still has not implemented 
disaster program reforms which this committee authored when I 
was chair in 2008. What are the major reasons why SBA has not 
established the needed Disaster Assistance Program? 
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Mr. SHEAR. When we have done work, repeated work, and ap- 
peared before this Committee on the Disaster Loan Program, there 
seemed to be some positive movement in the period after the act 
was passed, the establishment of a Office of Disaster Preparedness 
within SBA. There appeared, up until I would say 2010, some col- 
laboration that was going on between the Office of Disaster Pre- 
paredness, the Office of Disaster Assistance, and the Office of Cap- 
ital Access, to try to stand up a pilot program for IDAP as a first 
step to try to move into these areas to better serve the needs of 
disaster victims. I use the expression “the ball was dropped” by 
SBA. When we did our work on Sandy, this collaboration just 
seemed to fall apart, and we have not seen any evidence that there 
is really a collaborative effort, which I think is what is necessary 
here, for SBA to try to develop these three programs, including 
IDAP. 

Ms. VELAZQUEZ. To what degree do you think these reasons 
may be symptomatic of some of the more general operational chal- 
lenges you found in your management review? 

Mr. SHEAR. I think that it is a great question because one of 
our concerns, and sometimes we use a simple word like “silo effect.” 
SBA has a complex organizational structure, and you have report- 
ing relationships that differ from working relationships. And you 
have different parties that are involved here. And the idea that 
with disaster assistance, it involves a number of parties, and it just 
seems like what I will call a silo effect, as far as the inability to 
work across the organization, it is relevant to the work we did on 
enterprise risk management. The failure to identify risks that are 
common to the agency and working on those risks across the agen- 
cy, it just does not seem like that collaboration is there. And I real- 
ly have to be critical about our first interview dealing with the 
three private loan programs when we were doing the Sandy work 
where we were told that there was a conference call after Sandy 
occurred with three lenders, and the three lenders could not even 
be named. It was not a documented interview, but the three lend- 
ers did not like IDAP. Well, that was a case I had to direct to SBA 
the people that had been involved earlier that were part of this col- 
laborative effort to try to stand up IDAP, and that never came to 
the table. So it even seemed almost like if it was something that 
was developed, or there was work on such development by previous 
people in thpse positions, that had also kind of fallen off the table. 

Ms. VELAZQUEZ. So since the Tri-State area was affected by 
Hurricane Sandy, would you tell us that based on what you have 
seen, that if there is another large-scale disaster, such as Hurri- 
cane Sandy, that the SBA, will be prepared to tackle the challenges 
that we saw during Sandy? 

Mr. SHEAR. I do not think SBA has a real plan for addressing 
it, and especially when you have a congressional mandate to create 
three private loan programs, there was a rationale to those pro- 
grams. Much of it, like, for example, with IDAP, there is certainly 
in the Gulf Coast with Katrina, and based on our work on the 
ground with constituents in the Tri-State area with Sandy, there 
certainly appeared to be demand for things like a bridge loan type 
of program and things like that, and I do not think SBA has really 
put itself in a position to serve those needs. 
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Ms. VELAZQUEZ. Have you conducted any other management 
review with any other federal agency? 

Mr. SHEAR. As an agency, we did a lot of broad management 
reviews in basically the 1980s and 1990s, and now this was one 
time where we thought SBA was an agency, because of these recur- 
ring problems, that would require one. We currently have an ongo- 
ing general management review of HUD, and so that is one. We 
have done other things that would not be called general manage- 
ment reviews but are pretty broad looks at agencies, including one 
that we did a number of years ago at SBA. 

Chairmap CHABOT. The gentlelady’s time is expired. 

Ms. VELAZQUEZ. Thank you, Mr. Chairman. 

Chairman CHABOT. The gentleman from Missouri, Mr. 
Luetkemeyer, who is vice chairman of this Committee is recognized 
for 5 minutes. 

Mr. LUETKEMEYER. Thank you, Mr. Chairman. 

Mr. Shear, your report is quite damning and quite concerning 
from the standpoint that it looks like we have an agency that is 
mismanaged from top to bottom. You know, I represent the district 
in Missouri that just got hardest hit in our state with regards to 
flooding these past 2 weeks. And so when I look at the Office of 
Disaster Assessment and then, because it could not really figure 
out what to do, they created the Office of Disaster Planning, and 
now because they cannot coordinate those two with anybody else, 
they are going to create an Office of Disaster Interagency Affairs. 
This is an example of government run amuck. We have one agency 
that cannot do the job, so we create a second agency that cannot 
do the job, and now we have got a third agency. Am I misreading 
what is going on here, the ineptness of the agency caused it to cre- 
ate more agencies which continue to be inept? Yes or no works for 
that. 

Mr. SHEAR. Okay, thanks. I see your concerns. You raise a very 
good point, and basically, what we look for generally with the way 
SBA operates, including assessing the risk of meeting its mission 
that you just need more thorough plans on how to do this and just 
creating additional entities is not necessarily the way to do that. 
You really need to develop a plan and think strategically about 
how to deliver this assistance. 

Mr. LUETKEMEYER. Well, through your discussion in your re- 
port you talk about GAO had — their own IG had 11 different chal- 
lenges, and after 10 years only seven of them still existed. And 
some of them, as the chairman alluded to here, one of them is ex- 
tremely important, which is, you know, the security of the data 
that this agency holds. Other ones in there, improper payments. 
This is a pretty basic function of the agency I would assume. Do 
you know off the top of your head what the past due rate is of the 
portfolio? 

Mr. SHEAR. I am sorry, the what? 

Mr. LUETKEMEYER. The past due rate for the SBA loan port- 
folio? 

Mr. SHEAR. No. If you want to make a question for the 
record 

Mr. LUETKEMEYER. That is fine. I was just curious if you 
knew off the top of your head 
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Mr. SHEAR. No, I do not. 

Mr. LUETKEMEYER. — whether it was going up or down. That 
is always an indication of management problems when you have 
that as well as economic times. 

Also, you know, you are talking about they developed strategic 
plans, and yet, when they get the plan done, nobody goes in and 
is able to review it. Am I reading that right within your report? 
They develop strategic plans but yet there is no follow up as to see- 
ing if the strategic plan is followed and whether there is an evalua- 
tion of its effectiveness, whether it was accurate. 

Mr. SHEAR. The strategic planning, the deficiency we identi- 
fied — and it is consistent with other work we have done on indi- 
vidual programs — has been the lack of evaluations of its programs 
for effectiveness consistent with what the chairman brought up 
with GPRA. And here I refer to the GPRA Modernization Act, and 
state that there is a lack of evaluations, and the evaluations are 
not really being incorporated into strategic planning, and it is hard 
to really have an effective strategic plan if you do not have a con- 
cept of how well the various programs are working. 

Mr. LUETKEMEYER. Well, coming from the private sector, you 
need to have a strategic plan, know where you are headed. You 
need to have a review of that strategic plan on a regular basis so 
you know what you did right, what you did wrong, and how you 
can improve. And having a plan is fine, but if there is no follow- 
up action it is worthless. It is a waste of time. It is an exercise in 
futility. 

Also, you talk about the standard operating procedures here in 
rules and regulations, which seem to be either ignored or they just 
create them and they just kind of go off on their own tangent. 
There is no coordination. Can you elaborate just a little bit on that? 

Mr. SHEAR. Yes. It is in and of itself that the standard oper- 
ating procedures are so out-of-date and are not kept up-to-date, 
and they might be being relied upon too heavily because there is 
a lack of specificity to begin with for operating programs. But if you 
put the different pieces together from what we have done, you have 
staff that are in the district offices. They are referred to as the 
“boots on the ground,” so you have staff in district offices that are 
not being well trained to conduct their functions. When you have 
that, when you do not have clear guidance, we found it with indi- 
vidual program audits, clear guidance for how those regulations are 
supposed to be carried out, and then you are doing things in a 
makeshift manner that the SOPs do not reflect current practices, 
you are going to have what we have observed, which is a lot of in- 
consistency and incomplete oversight of SB A programs. 

Mr. LUETKEMEYER. I appreciate that. And just one moment of 
indulgence by the chairman, you know, it would seem to me that 
if we have this kind of, to me, reckless regard for the reports that 
are sent out, reckless regard for the recommendations, there needs 
to be some sort of punitive action taken by us, Mr. Chairman, 
against this agency, starting with freezing of their funds and freez- 
ing of all future rules and regulations and SOPs. If they cannot do 
the job with what they have got now, they do not need to be doing 
anything further. So I certainly will want to work with you on 
something along those yields, and I yield back. 
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Chairman CHABOT. Thank you. The gentleman’s time is ex- 
pired. 

The gentlelady from California, Ms. Chu, who is the ranking 
member of the Economic Growth, Taxation, and Capital Access 
Subcommittee is recognized for 5 minutes. 

Ms. CHU. Mr. Shear, from this report it seems that there is 
some general agreement between SBA and GAO on the rec- 
ommendations that GAO has made to address important problems 
that the agency is facing. It is of concern that of the 69 rec- 
ommendations, that only seven have been met. However, it is also 
clear that SBA has taken steps to address at least some of the 
issues at hand. In preparing this report, did you find disagreement 
between SBA and GAO on what GAO recommendations should be 
considered completed or fully implemented by the agency? 

Mr. SHEAR. Over the past year, I would say roughly since last 
April or May, there has been a lot more focus at SBA in looking 
at our open recommendations, which is a long list. And it has been 
reported to this Committee before. SBA’s track record over the 
years in addressing our open recommendations has not been very 
good. The comptroller general actually in November sent a letter 
to the administrator like he did to other heads of agencies, and in 
this case, SBA’s implementation rate, the way we calculate that 
rate is around 58 percent and most of the government is around 
80 percent. So this has been a concern of ours. 

We have seen some attention and movement on this, and there 
has been, I think, a push from senior management, I would say 
roughly since last summer, and we have had multiple meetings at 
SBA, including senior leadership over our open recommendations, 
so it is a positive sign. So the idea was this actually represents an 
improvement. As you see in my statement that seven were imple- 
mented since issuance of our report is a positive change from what 
had occurred before, and there were a few that were implemented 
I would say roughly last summer, for example. I made reference in 
my statement to some recommendations we made in a report on 
the 8(a) program in 2010. So there is more attention to this. 

There are certain times when we get information from SBA and 
it says, “Here it is. We think we have implemented the rec- 
ommendation.” That requires a lot of follow-up, and there are cer- 
tain times where we just do not agree. There are certain times we 
explain in excruciating detail why we do not agree that a rec- 
ommendation is implemented. Sometimes there is a back and forth. 
I will give an example. On disaster loans, the one dealing with the 
early submission of applications, that is one where it required some 
back and forth but I would say, James Rivera and his team worked 
very well with us in saying, okay, “What do we have to do to con- 
vince you that we are addressing your recommendation?” And we 
went through the different pieces of what we needed to understand. 
So it is a very collaborative process between us and SBA. There is 
more attention at SBA to make this process work now, but the 
agency is still very challenged in terms of addressing these rec- 
ommendations. 

Ms. CHU. There were seven recommendations that went to full 
completion. Can you tell me why you believe SBA chose to 
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prioritize these over the others and what was it that made these 
recommendations rise to the forefront? 

Mr. SHEAR. I think that there was one of the things that was 
always present here, the chief of staff said there was an emphasis 
in looking at the 8(a) program. And I would say the associate ad- 
ministrator that is relatively new to the position certainly reached 
out to us with the idea that she was taking these recommendations 
seriously and wanted to better understand what those rec- 
ommendations were. And, they are somewhat dated, but they are 
still, we think, very relevant. So we were explaining the context — 
why were the recommendations the nature of what they were? And 
it had to do with how the program was operated, when we were 
writing the report. So there was a fair amount of back and forth 
and, as we stated, that just prior to issuance of our report four of 
the six recommendations from the 2010 report, were implemented. 
So I think there was a focus on 8(a) by both senior management 
at SBA and also, likewise by the associate administrator herself of 
the program. 

Ms. CHU. Okay. And if there is disagreement, how do you move 
forward if there is disagreement between the SBA and the GAO? 

Mr. SHEAR. A lot of times it is not disagreement but it is kind 
of a question, does this do it for us? And sometimes the focus be- 
comes very much we need documented evidence that you have ac- 
tually conducted a change. Like, for example, there are many times 
where we stated that district office staff needed better guidance for 
the 8(a) program and other programs for how to carry out their re- 
sponsibilities, and they would provide us dates where they are stat- 
ing that training occurred, and we just say that, okay, so tell us 
what the training entailed. We have to see some substance as far 
as what is happening here. So it tends to be a back and forth proc- 
ess, and sometimes we reach resolution. A lot of it is just having 
a focus on these issues. Many of these issues, there is a real focus 
and a determination. They are not simple issues. They will take 
time to address. But without the focus on the issues, it is not going 
to happen, and I think you see a situation here where many of 
these issues have not had that focus. 

Chairman CHABOT. Thank you. The gentlelady’s time has ex- 
pired. 

The chair would just note that if you had a teenager and you told 
them to clean up their room, they had 69 things sitting around the 
room and they cleaned up seven of them, that might be in a posi- 
tive direction, but I do not think most parents would be satisfied 
with that, and I certainly would not be inclined to give them an 
increase in their allowance. 

The gentleman from Mississippi, Mr. Kelly, is recognized for 5 
minutes. 

Mr. KELLY. Thank you, Mr. Chairman. And thank you, Mr. 
Shear, for being here. 

It is my understanding that doing any interviews with their em- 
ployees, that they require that their general counsel be present 
during this. In your experience, has that been the same routine 
with other organizations or other agencies when these investiga- 
tions are conducted? 



11 


Mr. SHEAR. No. The idea of having district counsel present 
when we are interviewing nonmanagement district employees, it is 
an experience we have not had with other agencies. 

Mr. KELLY. As a former prosecutor, generally, when people law- 
yer up, so to speak, that was kind of — when they did not have any 
reason to, when it was a routine just talking-to, there was gen- 
erally something behind that. 

It is so important when you have an SOP to understand an SOP. 
And putting on my military side of experience, we have SOPs in 
every military unit for every single thing that we do. And if you 
do not understand and use that SOP, it is really not a SOP because 
that stands for standard operating procedure. And if you do not 
know and understand it and use it, it is not an SOP; it is just a 
bunch of guidelines that you are not using. In your experience, is 
the SOP that the SBA has basically just a bunch of guidelines, or 
do they actually use and understand and update and continue to 
update their SOP? 

Mr. SHEAR. You have asked a few questions, and the easiest one 
to answer is have they been in the process of updating SOPs and 
bringing them up to what their current practices are and trying to 
create the guidance that the district office staff need. This lack of 
procedural guidance is one of the major deficiencies, one of the 
major, I would call it, rather new deficiencies, that we identified in 
this report. With the SOPs, there is an issue of how specific they 
are. So, for example, no matter how good the SOP is, because they 
are pretty general, the idea that when we had district staff saying 
to us, I was made a business opportunity specialist and I was han- 
dled the SOP and that was my training. I might be reporting anec- 
dotal evidence from one or two people but, the point is that within 
itself the SOP is not sufficient to really prepare somebody to carry 
out their job duties. 

Mr. KELLY. And now I want to talk about something else that 
is really important to the military side, which I do not see in the 
SBA, but that is risk management. And to understand risk, obvi- 
ously, you have to understand risk, first of all. And it is my under- 
standing they do not have any strategic plan. They do not have a 
risk management program which is ample to determine what the 
risks are, and do you know of any way, or do you think they are 
capable of, first of all, understanding their risk, and second of all, 
if they do understand it, are they capable of addressing the risk 
that they have experienced? 

Mr. SHEAR. It is a great question. As far as to strategic plan- 
ning, I think we did find many elements of a positive strategic 
planning process. The part that we really see as deficient is the in- 
clusion of evaluation in a strategic plan. 

With respect to enterprise risk management, it is almost like, 
well, they have identified the pieces of what would go into enter- 
prise risk management, but it requires a very cross-cutting ap- 
proach across the agency. They have created a board which is to 
say that at least in principle should be addressing these issues, but 
at first, there was unofficially a risk officer named. At the time it 
was a general counsel in 2009, and here we are years later and you 
just do not have the elements of a robust enterprise risk manage- 
ment system to really identify the risks not only from a financial 
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standpoint but the risks having to do with carrying out the agen- 
cy’s mission. Like, for example, in disaster assistance and the other 
pieces of the agency. So sometimes you can look at enterprise risk 
management and say, even before it was invented there were some 
basic common sense business practices where you could find simi- 
lar types of language. But in terms of the enterprise risk manage- 
ment that is becoming looked upon more by the Office of Manage- 
ment and Budget, it just is that it is at a very premature stage. 

Mr. KELLY. And just a final comment. I find it kind of funny 
that for the personal risk, they made sure they had counsel present 
at all interviews with employees, but they do not pay that kind of 
attention to the organizational risk and risk management plan. 

I yield back, Mr. Chairman. 

Chairman CHABOT. Thank you. The gentleman’s time has ex- 
pired. 

The gentlelady from New York, Ms. Meng, who is the ranking 
member of the Agriculture, Energy, and Trade Subcommittee is 
recognized for 5 minutes. 

Ms. MENG. Thank you, Mr. Chairman. 

The GAO identified several longstanding changes at the agency. 
Of course, of those that you have delineated, which are the most 
important when it comes to service delivery and more tangible and 
immediate resources for our small businesses, if you had to? 

Mr. SHEAR. As far as the longstanding business challenges, I 
would really focus on human capital and the need to really assess 
skills gaps to identify training that might be necessary. And all 
these different pieces fit together. Eor example, there are certain 
issues that are associated with, say, contracting programs that re- 
quire participation across the agency and the various parts of the 
agency. So they all kind of fit together in a certain way. But if I 
had to identify one that really stands out it would be the human 
capital challenges as far as a longstanding challenge. Another one 
that has come up here, which whether you call it longstanding or 
not, is the need to be able to document decisions and to evaluate 
how well your programs are working and to document those deci- 
sions. So these are some of the things that really stand out based 
on our work. 

Ms. MENG. The report notes that the SBA has made significant 
progress when it comes to the loan guaranty process. Do you be- 
lieve that the SBA in addressing human capital has helped it begin 
to turn the corner on some of those concerns? 

Mr. SHEAR. The concerns with loan guaranty. I am sorry, 
just 

Ms. MENG. Developing and implementing a quality control pro- 
gram for the loan centers to verify and document like compliance 
with the loan process? 

Mr. SHEAR. I do not know whether I can link it to human cap- 
ital or not, but among the work that we cite from the inspector 
general, there have been certain actions to address those long- 
standing challenges. I do not know whether it can be linked to any 
particular type of training or not. I just do not have an answer for 
that question. 

Ms. MENG. I was just curious. Thank you. I yield back. 

Chairman CHABOT. The gentlelady yields back. 
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The gentleman from Florida, Mr. Curbelo, is chairman of the 
Subcommittee on Agriculture, Energy, Trade, and Hoverboards is 
recognized for 5 minutes. 

Mr. CURBELO. Thank you for recognizing my unfortunate injury 
over the holiday break. I will reserve all my comments aljout 
hoverboards. 

Thank you very much for coming in today. There are a lot of spe- 
cific questions that have been asked, and I think they are all very 
important. But I want to ask you more broadly, I mean, is this just 
a cultural issue that is going to have to be addressed beyond the 
specific fixes that you may recommend? Is there just a cultural 
structural issue here that we should really focus on? I mean, I do 
not think Congress is particularly well equipped to get into the de- 
tails of how an organization is operating, but we can certainly lay 
out a vision and at least suggest a structure. And I am wondering 
if you can give us some guidance in that regard. 

Mr. SHEAR. You ask a great question, so I am going to stand 
back from what I will call the detailed auditing here and discuss 
how pieces fit together, and some of them fit in with enterprise risk 
management and some of the other matters we have talked about. 
I used the word earlier, and it has been used over the years with 
SBA of it being siloed, and the idea that you can have certain re- 
porting relationships and working relationships that are different. 
And part of that is you do not have the collaboration needed across 
the agency. So whether you are trying to implement enterprise risk 
management or simply just manage, how do you put together an 
operation that has this many pieces to it? There has to be a way 
of having collaboration across the agency. You have to have more 
of a culture where bad news can flow to the top. I really think the 
idea that over the years that there has not been that much focused 
attention on either our recommendations, or I think I can say that 
for the IG as well, that there has to be an ability for information 
to flow up and across the agency. And to some degree, if you step 
back from enterprise risk management, that is what part of this is. 

In terms of the concerns that SBA had with us interviewing, the 
question came up of interviewing nonmanagement district office 
staff. SBA officials raised a concern that we were giving a platform 
for people to complain. Now, this might just come from one or two 
people in SBA but I just say I do not get the sense that employees 
at SBA feel that they can offer honest feedback to leadership. And 
I know from all the efforts we have at GAO, to really embrace em- 
ployee feedback, that such feedback is important. All these pieces 
kind of fit together, and they fit together with issues associated 
with the organizational structure. So stepping back from basically 
this very detailed audit work, these are some of the observations 
that I would make. 

Mr. CURBELO. And I thank you because we are focusing on a 
lot of symptoms and, of course, that is important, but I think the 
root cause, and I agree with you, is a breakdown in communica- 
tions at SBA. And I look forward to having the administrator in 
here tomorrow and figuring out with her and with all of my col- 
leagues what we can do to promote a culture of communication 
where people feel free expressing how they feel, what their frustra- 
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tions are, and how they think the organization can work better. 
Thank you. 

Mr. SHEAR. Can I make one more point? 

Mr. CURBELO. Please. 

Mr. SHEAR. One of the things that — we did not do a general 
management review, hut earlier in President Bush’s administra- 
tion, we evaluated something called Agency Transformation. It did 
not work out real well. Then Steve Preston came in as adminis- 
trator, he implemented something he called business process re- 
engineering, and there were certain actions there. And a lot of that 
stretched toward the end of that administration. And so one of the 
things that we were very conscious of when we reported on those 
efforts was that there is really a need for someone or some group 
of people in senior positions, because by its very nature, political 
appointments change with each administration even when you do 
not have changes in party. So the idea here is that we were kind 
of looking at what senior executive service career people might be 
in a position to kind of take hold of some of these efforts and to 
expand them? And I think that is one of the issues that this Com- 
mittee should be thinking about and that SBA should be thinking 
about, because there is about a year left in this administration. 

Mr. CURBELO. Thank you. 

Chairman CHABOT. Thank you. The gentleman’s time is ex- 
pired. 

The gentlelady from North Carolina, Ms. Adams, who is the 
ranking member of the Investigations, Oversight, and Regulations 
Subcommittee is recognized for 5 minutes. 

Ms. ADAMS. Thank you, Mr. Chair. I am from North Carolina. 
It was a mistake. 

Thank you. Ranking Member Velazquez, as well, and Mr. Shear, 
thank you for being here and for your testimony. 

As an enthusiastic supporter of the work that SBA performs for 
our nation’s small businesses, it is critically important that the 
agency is run both efficiently and effectively. I am sure you would 
agree to that. But the GAO report noted that SBA is considering 
expanding SBA-1, an expedited application process, to include the 
8(a) program, which is critical for minorities to gain a foothold in 
the Federal Procurement Marketplace. Do you believe that this is 
a move in the right direction? 

Mr. SHEAR. It is a move that can be a promising move. From 
the basis of our audit work, on the use of technology, in this case, 
for the 8(a) program, I will emphasize the following. The Office of 
Management and Budget has very specific requirements that we 
have used in our audit work, our IT team that has worked with 
us on this, used, as far as analyzing existing IT, and in terms of 
requirements for investing in new IT. And SBA is engaged in a 
number of activities which SBA states that, might be sufficient for 
their IT outlook. But these very specific 0MB requirements are 
there for a purpose, and we think that if SBA really wants to use 
technology to improve program delivery, which is a good thing to 
be thinking about, that it should have a more rigorous method for 
following the requirements that 0MB has for IT investments and 
for the operational analysis of existing investments. 
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Ms. ADAMS. Thank you. GAO found that SBA had not con- 
ducted regular interviews of its operational IT investments to en- 
sure that they continue to meet agency needs. Why is this signifi- 
cant? 

Mr. SHEAR. For example, over time you might have certain sys- 
tems that you have in place that become redundant with new in- 
vestments, so that is part of the forward looking that I just men- 
tioned in answering your question about SBA-One. And it is signifi- 
cant that way. And it is important to know, especially when you 
have systems that have been in place for a long time, whether they 
still are effectively meeting the needs of the agency in delivering 
its programs. So you are running a little bit blind if you do not go 
through these steps. 

Ms. ADAMS. Thank you. And in its report, GAO found several 
issues that SBA has not resolved. So what are the key actions or 
management changes that SBA needs to take to address these 
challenges? 

Mr. SHEAR. I think that we reiterated that at the time it was 
69 recommendations from earlier reports and now it is down to 62 , 
but we had eight new recommendations. We think they are very 
substantive recommendations that are really necessary to be ad- 
dressed to try to improve the operations of the agency. 

Ms. ADAMS. Okay. Let me quickly ask. The review found that 
SBA field office employees are primarily evaluated on quantitative 
measures, not qualitative. GAO also found that employees have re- 
ported technical problems with aspects of the electronic perform- 
ance system. As a result, many field office employees feel that they 
are not being properly evaluated. So what is SBA doing to correct 
this problem? 

Mr. SHEAR. I think it is a good question to ask the adminis- 
trator because I really think that among these issues, a lot of it 
comes down to having, in terms of our work, it falls into the pieces 
of the human capital planning, the training that is involved, and 
the appraisal system where we do note that the system seems to 
be heavily dependent on quantity, like how many events did you 
hold rather than the quality of those events. And the development 
of performance standards really gets at the quality issue — all gov- 
ernment agencies have a challenge in this area — but I think SBA 
has a way to go this way, and I hope that they are developing re- 
sponses to that. 

Ms. ADAMS. Thank you. I am out of time. 

I yield back, Mr. Chair. 

Chairman CHABOT. Thank you. The gentlelady yields back. 

The gentleman from New York, Mr. Hanna, who is chairman of 
the Subcommittee on Contracting and Workforce is recognized for 
5 minutes. 

Mr. HANNA. Thanks. I appreciate that. 

I do not know where to go with this. There is so much to talk 
about, especially the new American dream and the old one, right, 
that people are saying is disappearing. It was always built by small 
business, and according to Walter Mead, who has written widely 
about this, that it is the key to the future, and small business plays 
such a critical role in this. 
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We are going to have the administrator here tomorrow to talk 
about this. It sounds like they are just ignoring you; that they do 
not regard you as either your agency either knowing what you are 
talking about or they do not consider it important because it does 
not feel like there is any urgency to this. And yet, we know that 
about 2 to 3 percent of business loans in this country flow through 
them and that number is growing. And we have authorized more 
money to go into those programs. But what do we really do about 
this? It sounds like we are going to have this same meeting again 
next year. 

Mr. SHEAR. I think oversight is important, and I would say 
there has been a slight change at SBA. I do not know how exten- 
sive the change is. We will see over time. But the idea that last 
summer, certain efforts were initiated by GAO and SBA. It was not 
just by me and our team. It included my managing director. It also 
included the new chief of staff at SBA convening meetings to go 
over open recommendations. 

Mr. HANNA. Do they take you seriously? Or do you believe that 
they agree with you or that they want to implement what you are 
asking? It sounds like they are just stonewalling you. 

Mr. SHEAR. It is one area where we see some positive move- 
ment. So unlike all the other times that I have been here and said, 
well, SBA seems to always agree but then it is very rare that ac- 
tions are fallen. It is just in certain pockets and certain programs 
where we might have an associate administrator who is really in 
tune with our recommendations that an action is taken. There 
seems to be some movement, but I think time will tell, and I would 
hope 

Mr. HANNA. Is it just the case you have no levers to pull to 
make them do and follow your recommendations? All it is is polite 
conversation? 

Mr. SHEAR. So let me go back to what we do as an agency. Just 
recently, the Comptroller General, Gene Dodaro, testified about the 
importance of agencies implementing our recommendations and 
how doing such can improve the functioning of government. And 
this was all tied in again with him sending letters to the heads of 
agencies on recommendation implementation rates. We do get a lot 
of movement in the sense that government-wide, 80 percent of our 
recommendations are implemented. We just do not have that track 
record at SBA. We have not had it. There has been some positive 
movement 

Mr. HANNA. You said they are at a 50 percent productivity level 
compared to other agencies that are closer to 80 or more. 

Mr. SHEAR. Yes. 

Mr. HANNA. So the proof is in those numbers, that they are not 
highly functioning. So what would you ask Administrator Sweet to- 
morrow when she is here? I can imagine, but 

Mr. SHEAR. What would I ask? Many of the questions that you 
are asking me today are probably good questions to ask. But part 
of this is the areas where we are looking for in a sense of some of 
the bigger issues. For example, for SBA to come back to us and say 
during the course of this, which is saying, have you assessed your 
organizational structure? Because our analysis indicates that there 
are a lot of challenges associated with it. So either you have to 
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change the structure or you have to do things to address the chal- 
lenges. 

Mr. HANNA. What you are saying is that they just do not care. 

Mr. SHEAR. But then we get a response at the agency comment 
period, and then we get response now in a 60-day letter saying we 
have evaluated organizational structure. So really, the idea of real- 
ly establishing very firm plans that would extend into the next ad- 
ministration is important. What plans does she have for what she 
wants to achieve. 

Mr. HANNA. So the long-term structural changes that are per- 
manent and not based on the changes in command? 

Mr. SHEAR. Yes. I think that to really focus on some of the orga- 
nizational structure issues and the associated — a lot of these things 
fall together. The human capital issues, the training needs, all 
those different pieces. I think, what is your plan for getting the 
agency to be a more highly functioning agency? 

Mr. HANNA. My time is expired. 

Chairman CHABOT. Yes, the gentleman’s time is expired. 

The gentleman from Massachusetts, Mr. Moulton, who is the 
ranking member of the Health and Technology Subcommittee, is 
recognized for 5 minutes. 

Then we will go to Ms. Radewagen, who is American Samoa, and 
she is also the chair of the Subcommittee on Health and Tech- 
nology. 

Ms. RADEWAGEN. Thank you, Mr. Chairman. Welcome, Mr. 
Shear. 

During the GAO’s investigation of mismanagement of SBA, did 
you find that any regional offices took on more responsibility than 
other regional offices? Eor instance, there are two U.S. territories 
that do not seem to have regional representation, let alone a dis- 
trict office. Would it be accurate to say that SBA has neglected cer- 
tain regions while perhaps overserving other regions? 

Mr. SHEAR. You ask a great question and I wish that I could 
say that we did audit work to see what representation there was 
of regional and district offices in a specific outreach, but we did not 
try to geocode the different activities of the various district offices 
in particular. It is a very good question but our audit work just 
do6S not nddross it 

Ms. RADEWAGEN. Thank you, Mr. Chairman. I yield back. 

Chairman CHABOT. The gentlelady yields back. 

The gentleman from Virginia, Mr. Brat, is recognized if he has 
any questions. 

Mr. BRAT. Thank you, Mr. Chairman, I have no questions. 

Chairman CHABOT. Okay. If not, I think the ranking member 
has another^ question, and we now yield to her. 

Ms. VELAZQUEZ. Mr. Shear, you know, I cannot help but feel 
frustrated because we have been in this predicament for so many 
years. I have been sitting on this committee for 23 years, and the 
Disaster Loan Program has been one that I care about because it 
has impacted New York City. We have worked on legislation since 
Katrina and here we are today passing a new law that I authored 
to reopen the Disaster Loan Programs because the percentage of 
decline in loan applications were so high. I am happy to see that 
the administration is moving to provide the assistance people de- 
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serve, particularly the victims of Hurricane Sandy. But tomorrow 
we are going to have the administrator before us. We are going to 
have to ask the tough questions that need to be asked based on the 
review you just conducted. My question to you, after listening to 
my colleagues and the answers that you have provided, is that it 
looks like someone needs to be in charge of watching the store, 
right? And it goes to the issue of the organizational structure that 
could survive the fact that pretty soon we are going to be looking 
at a new administration in the White House. How can we address 
that? Who do we hold accountable in terms of making sure? Be- 
cause you said that in terms of the 8(a) program, well, there is an 
associate administrator that cares about making sure that the sug- 
gested recommendations are implemented to make the program 
better. Nevertheless beyond the administrator, is there anything 
that could be done at the organizational structure of the agency 
that will be accountable in making sure all these recommendations 
are implemented? 

Mr. SHEAR. At the organizational structure level, one of the 
most basic things that we said was there is nothing magical about 
having the 10 regional offices and the 68 district offices and dif- 
ferent lines of reporting, in terms of working relationships and re- 
porting relationships. There are other ways the agency could struc- 
ture itself We do not feel that we have the basis for saying this 
is what the organizational structure should be, but we certainly 
identify that there are these challenges. And you know, when we 
reported on the 8(a) program, it is a symptom of a situation where 
you have district staff that are not necessarily sure what their jobs 
are in terms of continued eligibility and things like that and the 
oversight that is needed. But from a standpoint of organizational 
structure, there was a consultant’s report, and when it was not 
given to us, we did not feel that was very important because the 
important thing is what are you doing SBA to address, if you are 
going to keep your organizational structure largely intact, how are 
you going to address these issues that are associated with it? And 
we still have not seen anything. When we followed up with them 
last month, we still do not see anything in terms of what are you 
going to do about the structure of this agency, or if you are not 
making structural changes, how are you making changes to make 
sure that people are accountable and that people are trained to do 
their jobs and they understand what their jobs are? And I think 
those are some of the more fundamental issues that we really have 
here. You can put all these other things aside and you say that is 
some of the more fundamental issues that have been around for 
years. There are a lot of things we have talked about over the 
years with individual programs and even looking more broadly 
across the programs that now fall under the rubric of enterprise 
risk management. But that actually gives a pretty good rubric as 
far as saying how do you really define what the mission of the 
agency is and how you put the pieces together. And then the other 
piece that we would certainly discuss, with this Committee and we 
have discussed with you over the years, we think of the GPRA 
Modernization Act and the need to collaborate across agencies, 
whether it be USDA Rural Development or these working groups 
that the Office of Management and Budget have set up for collabo- 
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ration in delivering assistance, things like that, a more collaho- 
rative approach would be the other things that really stand out 
when I just step back from all these individual recommendations. 

Ms. VELAZQtJEZ. Thank you. Thank you, Mr. Chairman. I yield 
back. 

Chairman CHABOT. Thank you. Thank you very much. The 
gentlelady yields back. Her time is expired. 

Just one quick question, Mr. Shear. What is your assessment of 
the SBA’s response to the GAO report that was submitted to Chair- 
man Chaffetz and the Committee on Oversight and Government 
Reform? 

Mr. SHEAR. Oh, boy. You asked for a short answer. 

One of the things that it does note and I think that I would ex- 
pect in a 60-day letter, because I have read enough 60-day letters 
and comments in our draft reports from SBA to know certain com- 
mon themes, such as we agree and we are taking action. Some of 
the things that reflect something positive that is in my statement 
was even though it might be a small number of recommendations, 
a relatively small number over the last year, that there is at least 
some focus on those recommendations, and I hope it is not viewed 
as just a fire drill within SBA that they are trying to do this over 
a short period of time, but they are trying to create a culture and 
a management structure that can work over time, even into the 
next administration on working on those issues. 

So as far as there is a lot of activity going around, and a lot of 
what we found in doing this work and that we found in looking at 
other programs, particularly the contracting programs over the 
years, there is always a lot of activity around things that are some- 
how related to certain things that we are finding, but the idea of 
going the extra mile is not quite there. There are a lot of initiatives 
and activities that have occurred but it is a matter of taking it to 
the next level. 

Let me just mention two things that are in the letter where I just 
say that raises a little bit of concern. One is that I have already 
referred to, that the agency has conducted an assessment of its or- 
ganizational alignment. It is not just for the purpose of documenta- 
tion or for our audit work that we see documented evidence of a 
thorough evaluation. It should be an important living document 
over time that its current leadership and future leadership can rely 
on in terms of addressing the issues of the agency — it is not as im- 
portant as to whether we see the assessment or not. What is impor- 
tant is that there is documented evidence of a thorough examina- 
tion of the organizational structure. And then the other one, there 
was reference made to doing the operational analyses of the IT. 
This is one where the requirements that 0MB has are very specific 
and our IT team relies on the 0MB guidance. And this is one 
where there is a statement in there that, we and our IT team take 
some exception to that, we have not seen documented evidence that 
the required operational analyses have been done. So there might 
be good things going on in the agency in terms of oversight of its 
IT, but we just do not see documented evidence that meet these 
very specific requirements that 0MB has. 

Ms. VELAZQUEZ. Would the gentleman yield? 

Chairman CHABOT. I yield. 
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Ms. VELAZQUEZ. On the IT issue, you say that there has to be 
oversight, 0MB, do they conduct any oversight? 

Mr. SHEAR. I would like to follow up with the Committee on 
that and really get the full input. I know that my colleague, Dave 
Powner, our director in the IT team has testified before this Com- 
mittee, and I would want to follow up with him on specifically the 
oversight of 0MB. My simple answer to your question is yes; 0MB 
is involved in conducting oversight. Whether it is a question for the 
record or whether, with Committee staff of following up with Dave 
and his team, who have collaborated with us so much on this work, 
I think that could give a more complete answer than what I could 
give you. 

Ms. VELAZQUEZ. Okay. 

Chairmaq CHABOT. Okay. Reclaiming my time. 

Ms. VELAZQUEZ. Thank you. I yield. 

Chairman CHABOT. I would just note that we have heard the 
shortcomings, the deficiencies. I could use a lot of other words, too, 
but the problems that are going on at the SB A at this time, the 
administrator will have an opportunity tomorrow to address the 
Committee and then to take questions as well, and we would invite 
members on both sides of the aisle and the public to attend and 
hear the response tomorrow as well. It is at 11 o’clock in the morn- 
ing. 

I would ask unanimous consent that members have 5 legislative 
days to submit statements and supporting materials for the record. 
Without objection, so ordered. 

If there is no further business to come before the Committee, we 
are adjourned. Thank you very much. 

[Whereupon, at 12:15 p.m., the Committee was adjourned.] 
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SMALL BUSINESS ADMINISTRATION 

Leadership Attention Needed to Overcome 
Management Challenges 


What GAO Found 

As GAO reported In September 201 5, the Small Business Administration (SBA) 
has not resolved many of its long-standing management challenges due to a lack 
of sustained priority attention overtime. Frequent turnover of political leadership 
in the federal government, including at SBA, has often made sustaining attention 
to needed changes difficult (see figure below). Senior SBA leaders ha^e not 
prioritized long-term organizational transformation in areas such as human 
capital and Information technology (IT). For example, at a 2013 hearing on SBA’s 
budget, the committee Chairman st^ed that SBA’s proposed budget focused on 
the agency's priorities but ignored some long-standing management deficits. This 
raises questions about SBA’s sustained commitmentto addressing management 
challenges that could keep it from effectively assisting small businesses. 


Turnover in Senior-tever Positions at SBA, 2005 through 2015 
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Many of the management challenges that GAO and the SBA Office of Inspector 
General (OIG) have identified o\«r the years remain, including some related to 
program implementation and oversight, contracting, human capital, and IT, SBA 
has generally agreed with prior GAO recommendations that were designed to 
address these issues and other challenges related to the lack of program 
evaluations. The agency had made limited progress in addressing most of these 
recommendations but had recently begun taking some steps. A senior SBA 
official told GAO that improving human capital management, IT, and the 8(a) 
program (a business development program) were priorities for the current 
administrator For example, he stated that SBA was exploring creative ways to 
recruit staff and plans to expand SBA One — a database currently used to 
process loan applications— to include the 8(a) program. Also, SBA had begun 
addressing some internal control weaknesses that GAO and the SBA OIG 
identified as contributing to the agency’s management challenges. SBA officials 
noted that the agency had begun to update its standard operating procedure 
(SOP) on internal controls and planned more revisions after the Office of 
Management and Budget (OMB) updated its Circular A-1 23, which is expected to 
include guidance on implementing GAO’s2014 revisions to federal internal 
control standards. OMB issued a draft of the revised circular in June 2015 and as 
of September 2015 was reviewing comments it received. 
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In September 201 5, GAO maintained that 69 recommendations it made in prior work continued to have merit and should 
be fully implemented. As of December 201 5, SBAhad implemented 7 of these recommendations, including those 
pertaining to disaster assistance and Small Business Innovation Research. For example, SBA revised its planning 
documents to adjust staffing and resources availaWe forftjture disasters by conskiering the potential effect of early 
application submissions for disaster loans as GAO recommerfoed. Such actbn should help improve the agency's timely 
response to disasters, in addition, SBA had initiated actions in response to the eight new GAO recommendations. For 
example, SBA officials told GAO that the agency had estabished an Economic Impact Evaluation Working Group, which 
was developing evaluation plans for several program offices. 

GAO identified management areas in which SBA had not incorporated key principles or made other improvements, 
including; 


• Strategic planning and program evaluation; The 

strategic planning activities that GAO reviewed met most 
federal requirements. But SBA did not describe how it 
used results from the few program evaluations it had 
completed to help develop its current strategic plan, as 
required by the GPRA Modernization Act of 2010. OMB 
has encouraged agencies to increase their use of 
program evaluations, but SBA has not routinely 
conducted them and still iacJ<s evaluations for 10 of 19 
programs GAO reported on in 2012. Without evaluations, 
SBA lacks critical information for ensuring the validity 
and effectiveness of (1) its goals, objectives, and 
strategies; and (2) both new and existing programs. 

• Human capital management; SBA inpreved its human 
capital plan by developing goals and objectives. SBA 
also conducted early retirement programs in fiscal years 
2012 and 2014 to begin addressing long-standing ^ill 
imbalances, but fewer people than expected retred. SBA 
risked compromising these etorts because it did not first 
conduct a skills assessment or develop a workforce plan 
that would allow it to target its hiring and retention efforts. 
As of December 201 5. SBA had not yet developed a 
workforce plan and had not conducted a skills 
assessment ordetemiined training goals. As a result 
SBA cannot provide reasonable assurance that its 
workforce has the skills the agency requires. 

• Organizational structure: SBA's organizational 
structure has created complex o\erlapping relationships 
among offices that have contributed to challenges in 
program oversight. Although SBA recently completed an 
assessment of its organizational staicture and 
determined that major restructuring was not warranted at 
that time, it has not documented this effort Until SBA 
documents Its assessment, it will not have an institution^ 
record of its actions, and it will be difficult for SBA or a 
third patty to validate that SBA’s current organizational 
structure is confributing effectively to its misaon 
objectives and programmatic goals. 


• Enterprise rl^ management: Given the range of 
programs SBA manages and oversees, having a robust 
enterprise risk management (ERM) system is critical to 
effectively managing risks. SBA initiated efforts to 
implement ERM in 2009 and developed a framework to 
guide its ERM approach in 2012. But the agency has not 
incorporated some elements of a risk management 
framewor1<, such as goals and specific actions. Wfriout 
incorporating these elemente, SBA cannot reasonably 
ensure that its ERM efforts folly identify, assess, and 
manage risks. 

• Procedural guidance: As of March 2015, SBAhad 
determined that 74 of its 165 SOPs needed to be 
revised, 31 needed to be canceled, and 60 required no 
revision. An additional 9 needed to be issued. Federal 
internal control standards state that documentation must 
be properly managed and maintained, yet SBA has 
generally not set time frames for periodically reviewing 
and completing needed revisions or updates. Without 
such time frames, SBA staff and their partners may lack 
the guidance they need to effectively deliver program 
services in accordance with laws and regulations. 

• Information technology: SBA had not implemented 
more than 30 SBA OiG recommendations related to IT 
security but has recently increased its emphasis on 
improvements, according to a senior official. Further, 
SBA had only partially implemented several required IT 
management initiatives. For instance, SBA established 
policies to consolidate the number of its data centers and 
manage software licenses for IT investments. However, 
contrary to OMB guidance SBA had not conducted 
regular reviews of its operational IT investments to 
ensure that they contiruie to meet agency needs. Until 
SBA folly implements all of the required IT management 
initiatives, the agency cannot provide reasonable 
assurance that its IT investments are cost-efective, meet 
agency goals, or are effectively managed. 
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Chairman Chabot, Ranking Member Velazquez, and Members of the 
Committee: 

Thank you for the opportunity to discuss our general management review 
of the U.S. Small Business Administration (SBA). SBA oversees a 
number of programs that are designed to provide small businesses with 
resources and tools, including access to capital, help with federal 
contracting opportunities, entrepreneurial counseling and training, and 
disaster assistance.' According to SBA, in fiscal year 2015 these 
programs aimed to support more than $32.5 billion in small business 
financing and nearly $4 billion in long-term investment capital and provide 
access to over $80 billion in federal contracting, among other things.^ 

My statement today is based on the key findings in our September 2015 
report on SBA's management and related updates on the status of 
recommendations. ® Specifically, this testimony discusses (1 ) the extent to 
which SBA has addressed previously identified management challenges; 
and (2) SBA’s management of its strategic planning, human capital, 
organizational structure, enterprise risk, procedural guidance, and 
information technology (fT). In preparing this statement, we relied on the 
work supporting our September 2015 report, as well as an interview 
conducted in December 2015 with SBA officials to discuss efforts they 
had undertaken to implement our recommendations. More detailed 
information on our scope and methodology can be found in our 
September 2015 report 

The work on which this testimony is based was performed in accordance 
with generally accepted government auditing standards. Those standards 
require that we plan and perform the audit to obtain sufficient, appropriate 


'SBA provides low-interest rate disaster ioans to businesses of all sizes, private nonprofit 
organizations, homeow ners, and renters to repair or replace real estate, personal 
property, machinery and equipment, and inventory and business assets that have been 
damaged or destroyed in a declared disaster. 

^Smali Business Administralion, Fiscal Year 2015 Congressional Budget Justification and 
Fiscal Year 2013 Annual Performance Report (Washington, D.C.; 2014), As of March 31, 
2015, SBA’s total loan portfolio was about $116.9 billion, including $110.3 billion in direct 
and guaranteed loans and $6.6 billion in disaster bans. 

^GAO, Small Business Administration: Leadership Attention Needed to Overcome 
Management Challenges, GAO-15- 347 (Washington, D.C.: Sept. 22, 2015). 

"040-15-347. 
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evidence to provide a reasonable basis for our findings and conclusions 
based on our audit objectives. We believe that the evidence obtained 
provides a reasonable basis for our findings and conclusions based on 
our audit objectives. 


SBA Has Not 
Resolved Many of Its 
Long-Standing 
Management 
Challenges 


In our September 201 5 report, we found that SBA has not resolved many 
of its long-standing management challenges due to a lack of sustained 
priority attention overtime. In a September 2008 report, we noted that 
frequent turnover of political leadership in the federal government, 
including at SBA, often made it difficult to sustain and inspire attention to 
needed changes.® SBA has undergone turnover in many of its senior 
leadership positions (see fig. 1). We found that senior SBA leaders have 
not prioritized long-term organizational transformation in areas such as 
human capital and IT. For example, at a 2013 hearing on SBA’s budget, 
the committee Chairman stated that SBA's proposed budget ignored 
some long-standing management deficits.® This raises questions about 
SBA’s sustained commitment to addressing management challenges that 
could keep it from effectively assisting small businesses. 


^GAO, Sma// Business Administration: Opportunities Existto Buildon Leadership's Efforts 
to Improve Agency Performance and Employ Morale, GAO-08-995 (V\feshington, D.C,; 
Sept. 24, 2008). 

®The Budget Outlook for the ^all Business Administration, hearing before the House 
Comrrtttee on&rell Business. 113th Cong. 2(2013). 
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Rgure 1: Turnover in Senior Leadership Positions at the Smatf Business Admirtlstration {SBA)from Calendar Years 2005 to 
2015 

InSividuats 
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General Counsel I 




O Indicates a new person in the position 
P«ma»nl staff 
Acting staf 
. 'Acant/Ur^nown 

Source: GAO wiatysisofSBAinfonTiBtion | GA0-18-I34r 


Note; The numberof permanent and acting offidalsmay not add up to the total because in some 
cases the acting official became thepermanei^ official. 


The long-standing management challenges that we and the SBA Office of 
Inspector General (OIG) have identified over the years are related to 
program implementation and oversight, contracting, human capital, and 
IT, among others (see fig. 2). SBA has generally agreed with dur prior 
recommendations, which were designed to address hot only thesd: issues 
but also other challenges related to the lack of program evaluatiOriSi W 
September 201 5, we reported that the agency had made lirnited progfess 
in addressing most of these recommendations but had receritly began 
taking some steps to address them. For example, a senior SBA official 
told us that improving human capital management, IT, and the 8(a) 
program (a business development program) were priorities for the current 
administrator. Also, SBA had begun addressing some internal control 
weaknesses that we and the SBA OIG identified as contributing to the 
agency’s management challenges. SBA officials noted that the agency 
had begun to update its standard operating procedure (SOP) on internal 
controls and planned more revisions after the Office of Management and 
Budget (0MB) updates its Circular A-1 23, which is expected to include 
guidance on implementing 2014 revisions to federal internal control 
standards. 0MB issued a draft of the revised circular in June 201 5 and as 
of September 2015 was reviewing comments it received. 
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Figure 2: Duration of Small Business Administration (SBA) Management Challenges Identified by the Office of Inspector 
General{OiG), as of Fiscal Year 2015 
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Source: GAO analysis of SBA OiG Manayemant Challenges Reports. Fiscje Years 2000-201S | GAO-16-11*T 

Note: Loan guarantee purchasesoccurwhen S8A purchasesguaranteesfrom lendersfollowing loan 
iiquidatioisordelinquencies. Loanagentsare sometimes used to prepare documentation for an SBA 
loan applicationand refer borrowersto lenders. The Loan Management and Accounting System Isa 
project to upgrade existingfinfflicial software and application modi^esand remove them from the 
mainframe environment. 


In September 201 5, we maintained that 69 recommendations GAO made 
in prior work continued to have merit and should be fully implemented. As 
of December 2015, SBA had implemented 7 of these recommendations, 
including those pertaining to disaster assistance and Small Business 
Innovation Research. For example, SBA revised Its planning documents 
to adjust staffing and resources available for future disasters by 
considering the potential effect of early application submissions for 
disaster loans, as GAO recommended. Such action should help improve 
the agency's timely response to disasters. ' Also with respect to disaster 
assistance, SBA completed a memorandum of understanding with the 
Department of Agriculture that increases collaboration between the two 
agencies on providing disaster assistance to small businesses and 


^GAO. Small Business Administration: Additional Steps Needed to Help Ensure Timely 
Disaster Assistance, GAO-14-760 (Wfeshington, D.C.: Sept. 29, 2014). 
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agricultural producers, as GAO recommended, ® As discussed below, SBA 
has also taken initial actions in response to the 8 new recommendations 
we made in our September 201 5 report to improve SBA's program 
evaluations, strategic and workforce planning, training, organizational 
structure, enterprise risk management, procedural guidance, and 
oversight of IT investments. For example, SBA officials told us that the 
agency had established an Economic impact Evaluation Working Group, 
which was developing evaluation plans for several program offices. In 
addition, SBA officials stated that the agency had hired a Chief Learning 
Officer in August 201 5 who would be the focal point for training and 
addressing the skill gaps identified in the workforce plan that is under 
development. 


SBA Planning and 
Oversight Are Limited 
in Several 
Management Areas 


In our report, we also found that SBA had not met a federal strategic 
planning requirement, incorporated key principles for human capital 
management, or made other improvements in key managementareas. 

• Strategic planning and program evaluation: The strategic planning 
activities that we reviewed met most federal requirements. But SBA 
did not describe how it used results from the fewprogram evaluations 
it had completed to help develop its current strategic plan, as required 
by the GPRA Modernization Act of 201 0. ® 0MB has encouraged 
agencies to increase their use of program evaluations, but SBA has 
not routinely conducted them and lacks evaluations for 1 0 of 1 9 
programs we reported on in 201 2. Without prioritizing resources to 
conduct more evaluations of its programs and incorporating the 
results into its strategic planning process, SBA lacks a critical source 
of information for helping ensure the validity and effectiveness of its 
goals, objectives, and strategies. In addition, SBA lacks pertinent 
information that would help in determining the effectiveness of both 
new and existing programs. We recommended that SBA prioritize 
resources to conduct additional program evaluations and use the 


®GAO. Disaster Assistance: USDA and SBA Could Do More to Help Aquaculture and 
Nursery Producers, GA0'12*844 (Washington, D.C.: Sept, 11, 2012), 

^Rjb. L. No. 111-352, 124 Slat. 3866 (2011). This act amended the Governrrent 
F^rformance and Results Actof 1993 (GPRA). 

’°GAO, Entrepreneunal Assistance: Opportunities Existto Improve Programs’ 
Collaboration, Data-Tracking, and Performance Management, GAO-12-819 (Washington, 
D C.: Aug. 23, 2012). 
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results of such evaluations in its strategic planning process. SBA 
generally agreed with these recommendations but noted that it would 
face challenges in implementing them. For example, SBA said that for 
some programs it did not have adequate information collection 
systems that could house and assess the data needed for 
evaluations. In December 2015, SBA officials told us that SBA had 
established an Economic Impact Evaluation Working Group, which 
was developing evaluation plans for several program offices. They 
also told us that SBA planned to include the results of any completed 
evaluations and a list of future evaluations in the agency’s next 
strategic plan (for fiscal years 201 8 through 2022) . 

Human capital management: SBA has improved its human capital 
plan by developing goals and objectives. SBA also made efforts to 
address long-standing skill imbalances by conducting early retirement 
programs in fiscal years 201 2 and 2014, but fewer people than 
expected retired. However, SBA risked compromising these efforts 
because it did not first conduct a skills assessment or develop a 
workforce plan that would allow it to target its hiring and retention 
efforts. As of December 2015, SBA had not yet developed a 
workforce plan and had not conducted a skills assessment or 
determined training goals. Without a workforce plan that fully 
addresses key principles, including a current agency-wide 
competency and skill gap assessment and a long-term strategy to 
close skill gaps, SBA cannot provide reasonable assurance that its 
workforce has the skills needed to meet the agency’s mission. 

Further, without a more strategic approach to its training and 
development programs, including incorporating training goals and 
measures and input on employee development goals in its training 
plan, it will be difficult for SBA to effectively establish priorities in its 
training initiatives or address skill gaps. We recommended that SBA 
(1) complete a workforce plan that includes key principles such as a 
competency and skill gap assessment and long-term strategies to 
address its skill imbalances, and (2) incorporate into its next training 
plan key principles, such as goals and measures for its training 
programs and input on employee development goals. The agency 
agreed with these recommendations. In December 2015, SBA officials 
told us that SBA planned to complete a workforce plan by mid-March 
2016 that was to include strategies for addressing skill imbalances. 
They also told us that the agency had hired a Chief Learning Officer in 
August 2015 who would be the focal point for training and addressing 
the skill gaps identified in the workforce plan. 
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Organizational structure: SBA’s organizational structure has created 
complex overlapping relationships among offices that have 
contributed to challenges in program oversight." For example, in a 
March 2010 report on the 8(a) business development program, we 
found a breakdown in communication between SBA district offices 
and headquarters (due in part to the agency’s organizational 
structure) that resulted in inconsistencies in the way district offices 
delivered the program. According to federal internal control 
standards, organizational structure affects an agency’s control 
environment by providing management's framework for planning, 
directing, and controlling operations to achieve agency objectives." A 
good internal control environment requires that the agenc^s 
organizational structure clearly define key areas of authority and 
responsibility and establish appropriate lines of reporting. Despite the 
organizational and managerial challenges it has faced, SBA’s 
changes to its organizational structure since fiscal year2005 have 
been piecemeal. Although SBA told us that it had recently completed 
an assessment of its organizational structure and determined that 
major restructuring was not warranted at that time, it had not 
documented this effort as of August 2015. Until it documents its efforts 
to examine its structure and any findings, it will be difficult for SBA to 
provide reasonable assurance or for a third party to validate that 
SBA’s current organizational structure is contributing effectively to its 
mission objectives and programmatic goals. 

In response to our initial recommendation that SBA complete its 
assessment of the agency’s organizational structure, S^ concurred 
but noted that the agency had recently completed that review and 
determined that major restructuring was not warranted at the time. 
However, SBA did not provide us with any documentation of its 
assessment. Therefore, we revised the recommendation to clarify that 


"We discuss SBA's organizational structure w ith a focus on its regional offices in a related 
report. See GAO. Small Business Administration: Viem on the Operational Effects of 
Closing Regional Offices, QAO-'\5'Z6'^ (Washington, D.C,: Sept. 22. 2015), 

’^GAO, Small Business Administration: Steps Have Been Taken to Improve Administration 
of the 8(a) Program, but Key Controls for Continued EligibilityNeed Strengthening, 
GAO-10-353 (Washington. D.C.; Mar. 30. 2010). The 8(a) business development program 
helps smaB, disadvantaged businesses to participate in the federal contracting market 
through sole-source and set-aside contracts. 

’^GAO, Standards for Internal Control in the Federal Government, GAO/AtMD-00-21 3 1 
(Washington, D.C: Noverrijer 1999). 
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SBA document its assessment, including the results and any 
changes. In Decen*er2015, SBA officials told us that they had not 
yet documented an assessment of the agency’s organizational 
structure. 

Ente rprise risk management: Given the range of programs SBA 
manages and oversees, having a robust enterprise risk management 
(ERM) system is critical to effectively managing risks. SBA initiated 
efforts to implement ERM in 2009 and developed a framework to 
guide its ERM approach in 201 2. However, it could not provide us with 
adequate documentation on the progress of these efforts or on any 
future plans. In addition, the agency has not incorporated elements of 
our risk management framework, such as goals and specific actions.” 
According to a senior SBA official, the Enterprise Risk Management 
Board plans to assess SBA's risks in the near future. The official plans 
to ask the board to consider our risk management framework at that 
time. Given the long-standing management challenges related to 
specific SBA programs discussed earlier, it may be challenging for 
SBA to establish an agency-wide ERM system. However, until SBA 
identifies and fully documents the steps that it plans to take to 
implement its ERM process and incorporates the elements of our risk 
management framework, it will not be able to provide reasonable 
assurance that its efforts effectively identify, assess, and manage 
risks enterprise-wide before they can adversely affect SBA's ability to 
achieve its mission. We recommended that SBA develop its ERM 
program consistent with our risk management framework and 
document specific next steps. SBA agreed with the recommendation. 
In December 2015, SBA officials told us that the Enterprise Risk 
Management Board had been meeting biweekly to identify risks and 
discuss alternatives for addressing these risks In accordance with our 
risk management framework. The officials also noted that the board’s 
charter had been drafted andwas undergoing final review. However, 
they did not provide a time frame for when they expected to complete 
this effort. 


”GAO. Risk Management: Further Refinements Needed to Assess Risks and Prioritize 
Protective Measures atf^s and Other Critical Infrastructure, GA 0-06-91 (Washington, 
D.C.: Dec. 15, 2005). V\fe developed our risk management framework by reviewing, 
analyzmg, and synthesizing several sources of information, including risk literature and 
our prevbus reports and testknonies; experts in the fields of risk management, risk 
modeling, and terrorism; and numerous frameworks from industry, government, and 
acadeiTK sources. 
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• Procedural guidance: As of March 201 5, SBA had determined that 
74ofits 165 SOPs needed to be revised, 31 needed to be canceled, 
and 60 required no revision. An additional 9 needed to be issued. 
Federal internal control standards state that documentation must be 
properly managed and maintained, yet SBA has generally not set time 
frames for periodically reviewing and completing needed revisions or 
updates. Without setting time frames to help ensure that SOPs are 
properly maintained and periodically updated. It will be difficult for 
SBA to hold staff accountable for updating the SOPs as intended and 
to illustrate its progress in doing so. Moreover, vwthout updated SOPs, 
agency staff and their partners may not have clear guidance on how 
to most effectively deliver program services in accordance vwth laws 
and regulations. We recommended that SBA set time frames for 
periodically reviewing and updating Its SOPs as appropriate. SBA 
agreed with the recommendation. In December 201 5, SBA officials 
told us that SBA was continuing to update its SOPs but did not 
provide a timeframe for when they planned to complete this effort. 

• Information technology: SBA has not implemented more than 30 
SBA OIG recommendations related to IT security but has recently 
increased its emphasis on improvements, according to a senior 
official.^® Further, SBAhas partially implemented several required 
high-priority IT management initiatives. For instance, SBA established 
policies to consolidate the number of its data centers and manage 
software licenses for IT investments. However, contrary to 0MB 
guidance SBAhas not conducted regular reviews of its operational IT 
investments to ensure that they continue to meet agency needs. Until 
SBA fully implements all of the required IT management initiatives, the 
agency cannot provide reasonable assurance that its IT investments 
are cost-effective, meet agency goals, or are effectively managed. V\fe 
recommended that SBAperform an annual operational analysis on all 
SBA IT investments in accordance with 0MB guidance. SBA 
concurred with the recommendation. In December 2015, SBA officials 
told us that the agency had several ongoing efforts to improve IT 


its fiscal year 2015 management challenges report, the Small Business Adrrinistration 
(SBA) Office of hspeclor General (OIG) found that SBA still needed to address long- 
standhg security weaknesses identified in 35 open IT audit recommendations. See SBA, 
OIG, The Most Serious Management and Performance Challenges Facing the Small 
Business Administration in Fiscal Year 201 5, Report No. 15-01 (Washington, D.C.: Oct. 
17, 2014). 
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infrastructure but did not have an update on efforts to perform an 
annual operational analysis. 

Chairman Chabot and Ranking Member Velazquez, this concludes my 
statement. I would be pleased to respond to any questions you or other 
Members of the Committee may have. 
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